Acceptable Use Policy

You may not use the EVALINK Site and Services to publish content or engage in activity that is illegal under applicable law, that is harmful to others, or that would subject us to liability, including, without limitation, in connection with any of the following, each of which is prohibited under this Policy:

Distributing malware or other malicious code.

Disclosing sensitive personal information about others.

Collecting, or attempting to collect, personal information about third parties without their knowledge or consent.

Distributing pornography or adult related content.

Promoting or facilitating prostitution or any escort services.

Hosting, distributing or linking to child pornography or content that is harmful to minors.

Promoting or facilitating gambling, violence, terrorist activities or selling weapons or ammunition.

Engaging in the unlawful distribution of controlled substances, drug contraband or prescription medications.

Managing payment aggregators or facilitators such as processing payments on behalf of other businesses or charities.

Facilitating pyramid schemes or other models intended to seek payments from public actors.

Threatening harm to persons or property or otherwise harassing behavior.

Purchasing any of the offered Services on someone else’s behalf.

Misrepresenting or fraudulently representing products or services.

Infringing the intellectual property or other proprietary rights of others.

Facilitating, aiding, or encouraging any of the above activities through the EVALINK Site and Services.

Any Customers or EVALINK Site visitors in violation of the EVALINK Site and Services security is subject to criminal and civil liability, as well as immediate account termination. Examples include, but are not limited to the following:

Use or distribution of tools designed for compromising security of the EVALINK Site and Services.

Intentionally or negligently transmitting files containing a computer virus or corrupted data.

Accessing another network without permission, including to probe or scan for vulnerabilities or breach security or authentication measures.

Unauthorized scanning or monitoring of data on any network or system without proper authorization of the owner of the system or network.

You may not consume excessive amounts of the resources of the EVALINK Site and Services or use the EVALINK Site and Services in any way which results in performance issues or which interrupts the Services for other End User. Prohibited activities that contribute to excessive use, include without limitation:

Deliberate attempts to overload the EVALINK Site and Services and broadcast attacks (i.e. denial of service attacks).

Engaging in any other activities that degrade the usability and performance of the EVALINK Site and Services.

Hosting or running malicious code or other scripts or processes that adversely impact the EVALINK Site and Services.

Operating a file sharing site or scripts for BitTorrent or similar, which includes sending or receiving files containing these mechanisms.

Web proxy scripts, such as those that allow anyone to browse to a third party website anonymously, are prohibited.

You may not use the EVALINK Site and Services to send spam or bulk unsolicited messages. We maintain a zero tolerance policy for use of the EVALINK Site and Services in any manner associated with the transmission, distribution or delivery of unsolicited bulk or unsolicited commercial e-mail, or the sending, assisting, or commissioning the transmission of commercial e-mail that does not comply with the U.S. CAN-SPAM Act of 2003 ("SPAM").

Your products or services advertised via SPAM (i.e. Spamvertised) may not be used in conjunction with the EVALINK Site and Services. This provision includes, but is not limited to, SPAM sent via fax, phone, postal mail, email, instant messaging, or newsgroups.

Sending emails through the EVALINK Site and Services to purchased email lists ("safe lists") will be treated as SPAM. We may terminate any EVALINK Account who sends out SPAM with or without notice.

We value the freedom of expression and encourage End User to be respectful with the content they post. We are not a publisher of End User content and are not in a position to investigate the veracity of individual defamation claims or to determine whether certain material, which we may find objectionable, should be censored. However, we reserve the right to moderate, disable or remove any content to prevent harm to others or to us or the EVALINK Site and Services, as determined in our sole discretion.

Copyrighted material must not be published via the EVALINK Site and Services without the explicit permission of the copyright owner or a person explicitly authorized to give such permission by the copyright owner. Upon receipt of a claim for copyright infringement, or a notice of such violation, we will immediately run full investigation. However, we generally require a court order from a court of competent jurisdiction, as determined by us in our sole discretion, to take down alleged infringing material from the EVALINK Site and Services. We may terminate the EVALINK Account with repeated copyright infringements. Further procedures may be carried out if necessary. We will assume no liability to any EVALINK Account of the EVALINK Site and Services for the removal of any such material. If you believe your copyright is being infringed by a person or persons using the EVALINK Site and Services, please get in touch with us to report copyright infringement.

You take full responsibility for maintaining reasonable security precautions for your EVALINK Account. You are responsible for protecting and updating any login account provided to you for the EVALINK Site and Services. You must protect the confidentiality of your login details, and you should change your password periodically. You are responsible for ensuring all End User provided software installed by you on the EVALINK Site and Services is updated and patched following industry best practice. We make no warranty express or implied for the security and operability of 3rd party software or scripts installed or run by you on the EVALINK Site and Services.

We reserve our right to be the sole arbiter in determining the seriousness of each infringement and to immediately take corrective actions, including but not limited to:

Suspending or terminating your EVALINK Account with or without notice upon any violation of this Policy. Any violations may also result in the immediate suspension or termination of your EVALINK Account.

Disabling or removing any content which is prohibited by this Policy, including to prevent harm to others or to us or the EVALINK Site and Services, as determined by us in our sole discretion.

Reporting violations to law enforcement as determined by us in our sole discretion.

A failure to respond to an email from our abuse team within 2 days, or as otherwise specified in the communication to you, may result in the suspension or termination of your EVALINK Account.

Suspended and terminated EVALINK Account due to violations will not be re-activated. A backup of EVALINK Account’s data may be requested, however, we may not be able to provide you with one and, as such, you are strongly encouraged to take your own backups.

Nothing contained in this Policy shall be construed to limit our actions or remedies in any way with respect to any of the prohibited activities. We reserve the right to take any and all additional actions we may deem appropriate with respect to such activities, including without limitation taking action to recover the costs and expenses of identifying offenders and removing them from the EVALINK Site and Services, and levying cancellation charges to cover our costs. In addition, we reserve at all times all rights and remedies available to us with respect to such activities at law or in equity.

If you have discovered and would like to report a violation of this Policy, please contact us immediately. We will investigate the situation and provide you with full assistance.

This Acceptable Use Policy makes an integral part of our EVALINK Agreement.

Virtual TNA Receiver

The Virtual TNA Receiver manages and monitors incoming connections from Sitasys TNA alarm transmitters. It retrieves alarm- and technical messages coming from Sitasys TNA alarm transmitters. It supports sending downstream commands Sitasys TNA alarm transmitters.

Manage and monitor connections from Sitasys TNA alarm transmitters

Receiving alarm- and technical message from Sitasys TNA alarm transmitters

Send downstream commands to Sitasys TNA alarm transmitters.

The connectivity between the Sitasys TNA transmitter and TNA-receiver is the responsibility of the Customer.

The Service is billed by the hour when its status is active. Each hour started is due. The bill for the previous month is finalized at the beginning of each new month. Shortly after, the bill is charged to your selected payment method.

"TNA" TNA is a range of transmitters developed by Sitasys that use a proprietary secure IP communication protocol.

This Service Description makes an integral part of our EVALINK Agreement.

Security Policy

All candidates need to undergo an extensive security clearance. Further, we carefully assess all candidates in a multistage interview process.

During onboarding, all new employees go through general information security training, where they are made aware of their responsibilities and applicable policies and procedures that they need to follow. Further, they undergo in-depth training appropriate to their role.

With periodical training, we keep our employees updated regarding information security, policies, and procedures. The security clearance is re-assessed at regular intervals.

We established principles and tools for continuous improvement within our organization. We regularly practice various scenarios to make sure employees have all the skills and knowledge they need.

During regular assessments done by external advisors, we challenge our operational excellence, to improve it constantly.

With our microservices architecture, we follow principles of least privilege and shared nothing. All services are designed to have to authenticate against our central IAM, authorizing the service to perform the only designated actions.

All newly written code must be peer-reviewed ideally with multiple but at minimum one peer. Continuously extended checklists help to provide a general baseline for peer code review. This baseline ensures that the review includes checking for security and resiliency as well as complying with coding standards. Peer code review also ensures continuous sharing of knowledge between employees.

Before deploying our services to production, we run security and resiliency tests with both automated and manual testing. We test in realistic environments and with realistic load and data.

When code is pushed, it automatically triggers several pipelines to start testing on our staging system.

After peer review and testing, features are thoroughly checked by team leads and the CTO before they are considered for deployment.

After successfully passing testing and all review processes new code is ready for deployment. Even though fully automated, deployments to production can only be triggered by a small set of people with the necessary security clearance and expertise. We only do rolling deployments that we test for zero-downtime rollout.

We use a two-region setup with using at least 3 availability zones (AZs) in each region. We built this setup for resiliency. The data center at AWS are built to meet the highest industry standards.

We use AWS Global Accelerator to improve resiliency, availability and latency of our endpoints. Using AWS Global Accelerator traffic will take a direct route from the nearest available AWS edge location in the global AWS network. The AWS Global Accelerator endpoints are protected by default from Distributed Denial of Service (DDos) attackes with AWS Shield.

With cloud AMQP we use the RabbitMQ service. The Cloud AMQP clusters are connected to our VPCs (Virtual Private Cloud) using VPC pairing, which is designed to secure to the connection.

We use Auth0 for authentication and authorization.

Sitasys’ web endpoints enforce the use of TLS/SSLWe use AWS services designed to encrypt data in transit.

We use AWS services designed to encrypt data at rest.

All our systems are closely monitored and experts are on call-duty 24/7. Running anomaly detection on important KPIs, allow us to detect irregularities at an early stage. Together with continuous tests, automated failover and autoscaling most issues are solved before they become a problem and affect the Services.

We ensure the security of our software and Services by conducting penetration tests by renowned security external companies.

As off this security policy date, we are certified against ISO 9001 and ISO 27001

We use the AWS Well Architected Framework to continuously assess and improve our architecture, practices and processes. We regularly let AWS Well Architected partners review our implementation of the AWS Well Architected Framework.

This Security Policy makes an integral part of our EVALINK Agreement.

Service Level Agreement

This Service Level Agreement (“SLA”) applies only to the Services listed below in section 1 (“Included Services”) and applies separately to each EVALINK Account using the Included Services. Capitalized terms used herein but not defined herein shall have the meanings set forth in the Agreement.

Service evalink talos AMS (“evalink talos AMS”)

Service evalink talos UI (“evalink talos UI”)

Service evalink talos Virtual SIA DC-09 Receiver (“Virtual SIA DC-09 Receiver”)

Service evalink talos Virtual TNA Receiver (“Virtual TNA Receiver”)

Service evalink talos Virtual Vanderbilt SPC Receiver (“Virtual Vanderbilt SPC Receiver”)

Service evalink talos Virtual VdS Receiver (“Virtual VdS Receiver”)

Sitasys will use commercially reasonable efforts to make the Included Services each available with a Monthly Uptime Percentage, during any monthly billing cycle, of at least 99.95% (the “Service Commitment”). In the event any of the Included Services do not meet the Service Commitment, you will be eligible to receive a Service Credit as described below.

Service Credits are calculated as a percentage of the charges paid by you to Sitasys under the concerned EVALINK Account for the applicable Included Service for the monthly billing cycle in which the Monthly Uptime Percentage fell within the ranges set forth in the table below:

We will apply any Service Credits only against future payments otherwise due from you for the applicable Included Service under the concerned EVALINK Account. At our discretion, we may issue the Service Credits to the credit card you used to pay for the billing cycle in which the unavailability occurred. Service Credits will not entitle you to any refund or other payment from Sitasys. Service Credits will be applicable and issued only if the credit amount for the applicable monthly billing cycle is greater than one Euro (1 EUR). Service Credits may not be transferred or applied to any other account. Your sole and exclusive remedy for any unavailability or non-performance or other failure by us to provide the Included Services is the receipt of Service Credits (if eligible) in accordance with the terms of this SLA.

To receive Service Credits, you will need to submit a claim by opening a case by e-mail to notice@sitasys.com with uptime link and docs. To be eligible, the credit request must be received by us by the end of the second billing cycle after which the incident occurred and must include:

(i) the words “SLA Credit Request” in the subject line;

(ii) the billing cycle with respect to which you are claiming Service Credits, together with the Monthly Uptime Percentage for the billing cycle and the specific dates, times, and Availabilities for each 5-minute interval with less than 100% Availability throughout the billing cycle;

(iii) your Request logs that document the Errors for your claimed outage (any confidential or sensitive information in these logs should be removed or replaced with asterisks).

If the Monthly Uptime Percentage of such credit request is confirmed by us and is less than the Service Commitment, then we will issue the Service Credits to you within one billing cycle following the month in which the credit request occurred. Your failure to provide the credit request and other information as required above will disqualify you from receiving Service Credits.

The Service Commitment does not apply to any unavailability, suspension or termination of an Included Service, or any other Included Service performance issues: (i) caused by factors outside of our reasonable control, including any force majeure event or Internet access or related problems beyond the demarcation point of the applicable Included Service; (ii) that result from any actions or inactions from you or any third party (e.g. scaling of provisioned capacity, misconfiguring workflows or integrations, EVALINK Account configurations or credential settings, disabling EVALINK Services, etc.); (iii) that result from you not following the best market practices and training materials available on the EVALINK Site; (iv) that result from your equipment, software or other technology and/or third party equipment, software or other technology (other than third party equipment within our direct control); or (v) arising from our suspension or termination of your right to use the applicable Included Service in accordance with the Agreement (collectively, the “SLA Exclusions”).

If availability is impacted by factors other than those explicitly used in our Monthly Uptime Percentage calculation, then we may issue a Service Credit considering such factors at our discretion.

“Availability” is calculated for each 5-minute interval as the percentage of Requests processed by the applicable Included Service that do not fail with Errors and relate solely to the provisioned Included Service. If you did not make any Requests in a given 5-minute interval, that interval is assumed to be 100% available.

An “Error” is any Request that returns a 500 or 503 error code.

“Monthly Uptime Percentage” is calculated as the average of the Availability for all 5-minute intervals in a monthly billing cycle. Monthly Uptime Percentage measurements exclude downtime resulting directly or indirectly from any SLA Exclusion (defined above).

an API or HTTPS request by directly calling the Publish API and/or an inability to access and use the web interface of Included Services through HTTPS with Chrome or Firefox browsers in their consumer version without third party add-ons.

A “Service Credit” is a dollar credit, calculated as set forth above, that we may credit back to an eligible account.

This Service Level Agreement makes an integral part of our EVALINK Agreement.

EVALINK Services List

Site management and storing alarms, executing manual or automated workflows based on trigger conditions.

User access to evalink talos UI, manual alarm management, configuration.

Description: Managing connections to, receiving alarms from, and sending downframes to SIA DC-09 alarm systems.

Description: Managing connections to, receiving alarms from, and sending downframes to Sitasys alarm transmitters.

evalink talos Virtual Vanderbilt SPC Receiver

Description: Managing connections and receiving alarms including audio/video data from Vanderbilt SPC panels. Sending down-stream messages to SPC panels.

Description: Managing connections to, receiving alarms from,
and sending downframes to VdS 2465-S2 and VdS SecurIP alarm systems.

Data Processing Agreement

This Data Processing Agreement (“DPA”) entered into by and between Customer and SITASYS AG, a Swiss société anonyme, with its principal place of business at Industriestrasse 6 4513 Langendorf SO (“Sitasys”) supplements the agreement between Customer and Sitasys governing Customer’s use of the Services (the “Agreement”) when the GDPR applies to Customer’s processing of Customer Data using/via the Services. This DPA is integrated by reference in the Agreement.

The parties agree that all terms that begins with a capital letter have the meaning ascribed to them in the Agreement or in this DPA.

Customer may process Customer Data as a Controller or as a Processor. Sitasys will process Customer Data as a Processor to Customer when Customer acts as a Controller and Sitasys will process Customer Data as a sub-processor to Controller when Customer acts as a Processor.

Sitasys processes Customer Data as a Controller for the training and support Services. Thus, the DPA does not apply to the processing of Customer Data for the training and support Services.

Each party will comply with all laws and regulations applicable to it and binding on it in the performance of this DPA, including the GDPR. Sitasys does not determine whether Customer Data includes Special Category of Personal Data or information subject to any specific law or regulation. Customer is responsible for determining whether the Services are appropriate for storage and processing of Special Category of Personal Data or information subject to any specific law or regulation and for using the Services in a manner consistent with Customer’s legal and regulatory obligations.

2.1. Sitasys will process Customer Data only on documented instructions from Customer. Customer agrees that this DPA, the Agreement and the provision of instructions via the EVALINK Account, use of the Services, configuration tools and APIs made available by Sitasys constitute Customer’s documented instructions regarding Sitasys’ processing of Customer Data (“Documented Instructions”).

2.2. When Customer acts as a Processor, Customer warrants to Sitasys that Customer's Documented Instructions, including appointment of Sitasys as a sub-processor, have been authorized by the relevant Controller.

2.3. Customer may request a change to the Documented Instructions or new additional instructions. Requested change or addition to the Documented Instruction require the parties to agree in writing to such change or addition and to the associated additional fees payable by Customer to Sitasys for implementing agreed change or addition. If Sitasys does not agree to a change or addition to the Documented Instructions requested by Customer or if the parties do not agree on the associated fees, then Customer is entitled to terminate this DPA and the Agreement in accordance with Section Termination of the Agreement.

The subject-matter of the processing is limited to Customer Data;

The duration of the processing is determined by the Customer via its EVALINK Account and will not exceed the duration of the Agreement (except as may be required by applicable law);

The purpose of the processing is to provide the Services pursuant to the Agreement;

The types of Personal Data processed by Sitasys while providing the Services are the types of Personal Data that the Customer elects to include in Customer Data.

The categories of data subjects may include Customer and End-Users such as Customer’s or End User’s employees, contractors, suppliers, and customers.

4.1. Sitasys will only process, or disclose to a third party, Customer Data, as necessary to (i) provide or maintain the Services, or (ii) comply with the law or a valid and binding order of a governmental body.

4.2. Sitasys will disclose Customer Data only to the extent compelled by law or a governmental body to do so. Sitasys will provide Customer a prior Notice of the compelled disclosure (to the extent legally permitted) and commercially reasonable assistance, at Customer's cost, if Customer wishes to contest the disclosure request.

4.3. Sitasys imposes appropriate contractual confidentiality obligations upon its personnel authorized to process Customer Data.

In a manner consistent with the nature, functionality of the Services, Sitasys will make available to Customer, features, functionalities to assist Customer to the fulfilment of Customer’s obligation to respond to data subject requests to exercise their rights under the GDPR. If a data subject contacts Sitasys to exercise its rights under chapiter III of the GDPR, Sitasys will forward such requests to Customer, or redirect the data subject to the Customer.

6.1. Sitasys may engage sub-processor(s) for carrying out processing activities on Customer Data on behalf of Customer (“Sub-processor(s)”). Sitasys provides a list of the Sub-processors on the EVALINK Site (“Sub-processors List”). Customer authorizes Sitasys to subcontract the processing of Customer Data to the Sub-processors in accordance with this DPA.

6.2. From time to time, Sitasys may engage new Sub-processors, Sitasys will update the Sub-processors List and Notify Customer of that update at least ninety (90) days before Sitasys provides new Sub-processors with access to Customer Data. If Customer objects to a new Sub-processor, then Customer may terminate the Agreement in accordance with Section Termination of the Agreement.

6.3. Sitasys will restrict Sub-processors’ access to Customer Data only to what is necessary to provide or maintain the Services to Customer in accordance with the Agreement and Sitasys will prohibit Sub-processors from accessing Customer Data for any other purpose. Sitasys will enter into a written agreement with Sub-processors and will impose on the Sub-processors at least the level of Customer Data protection required of Sitasys by the DPA.

6.4. Sitasys will remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processors that cause Sitasys to breach any of Sitasys’ obligations under this DPA.

Sitasys will implement technical and organizational measures against accidental or unlawful loss, access, or disclosure of Customer Data, as described in the Security Policy to the Agreement and Section Security of the Agreement.

Customer will only provide Customer Data to Sitasys when Customer determines that the technical and organizational measures implemented by Sitasys provide a level of security appropriate to the risk with respect to Customer Data.

8.1. Upon request, Sitasys will make available to Customer information to demonstrate Sitasys’ compliance with the obligations set forth in this Agreement.

8.2. Should the Customer deem reasonably in good faith that the information provided by Sitasys are not sufficient to verify compliance with this Agreement, Customer or another auditor mandated by Customer and accepted by Sitasys, may conduct an audit, including inspections, with reasonable advance Notice, within the limit of one audit per contractual year and to the extent the audit is not legally or contractually prohibited. Sitasys will commercially reasonably contribute to such audits. Such audit is strictly limited to verify compliance of Sitasys with the obligations set forth in this DPA and does not entail access to (i) other customers’ content, data and (ii) documents or systems unrelated to the performance of the Services registered by Customer.

8.3. Before the commencement of that audit, taking into account the nature, scope, context and purposes of the Services, and the risk for the data subjects, Sitasys and Customer will discuss, and agree, reasonably and in good faith, to the scope, modalities, procedure, timing, duration, commencement date, control and evidence requirements, and fees of the audit. Sitasys will not unreasonably retain its consent to delay or limit Customer’s audit. The audit shall not disrupt the Services or be a threat to the security of the (i) Services and (ii) customers’ content on the Services. Customer will impose confidentiality obligations on its internal or external auditors at least of the level of required of Sitasys under the Agreement and ensure, verify, and guarantee that the auditor possesses the necessary skills to conduct such audit. Customer is responsible for all costs and fees related to such audit, including all reasonable costs and fees for the time Sitasys spends on the audit and on providing to Customer information demonstrating its compliance pursuant to section 8.1 of this DPA, in addition to the rates for services performed by Sitasys. If the audit report generated by Customer’s audit includes any finding of material non-compliance, Customer will share such audit report with Sitasys.

9.1. If Sitasys becomes aware of a Security Incident, Sitasys will (i) notify without undue delay the Controller of the Security Incident, (ii) investigate the Security Incident, (iii) assist Customer in gathering the information listed in article 33 of the GDPR by making available to Customer relevant listed information taking into consideration the nature and security of the Services, the information reasonably available to Sitasys and Sitasys’ confidentiality obligations, (iv) take commercially reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident.

9.2. Notification(s) of Security Incidents will be delivered to Customer by any means Sitasys selects, including via email. It is Customer' sole responsibility to ensure contact information in its EVALINK Account is and remains, at all times, accurate.

9.3. Sitasys’ obligation to report or respond to a Security Incident under this section is not and shall not be construed as an acknowledgement by Sitasys of any fault or liability with respect to the Security Incident.

Customer Data will be processed within the European Union or countries recognized by a European Commission decision as ensuring an adequate level of data protection. Customer Data will be transferred to, and processed in, the countries in which the Sub-processors operate (“Sub-processors Countries”). Some of the Sub-processors Countries may not be recognized by a European Commission decision as ensuring an adequate level of data protection. Sub-processors Countries will be listed in the Sub-processors List.

All transfers of Customer Data to countries not recognized by a European Commission decision as ensuring an adequate level of data protection will be subject to appropriate safeguards as described in Article 46 of the GDPR.

11. Assistance in Complying with Customer’s Obligations

Customer will comply with its obligations pursuant to Articles 32 to 36 of the GDPR.

Sitasys will assist Customer in complying with Customer’s obligations pursuant to Articles 32 to 36 of GDPR as provided in this DPA.

During the term of the Agreement, Sitasys makes available to Customer functionalities and features that enable Customer to access, extract and delete Customer Data processed on the Services.

All Customer Content, including Customer Data, will be deleted upon effective termination of the Agreement unless Sitasys is required by applicable law to retain such data.

Unless otherwise defined in the Agreement, all capitalized terms used in this DPA will have the meanings given to them below:

“Controller” has the meaning given to it in the GDPR.

“Customer” means you or the entity you represent.

“Customer Data” means the Personal Data that Customer provides to Sitasys through the use of the Services under Customer’s EVALINK Account.

“GDPR” means Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

“Personal Data” has the meaning given to it in the GDPR.

“processing” (without capitalized terms) has the meaning given to it in the GDPR and “process”, “processes” and “processed” (without capitalized terms) will be interpreted accordingly.

“Processor” has the meaning given to it in the GDPR.

“Security Incident” means a breach of Sitasys’ security that resulted in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data.

“Special Category of Personal Data” has the meaning given to it in article 9 of the GDPR.

“Sub-processor(s)” has the meaning given to it in Section Sub-processing of this DPA.

“Sub-processors List” has the meaning given to it in Section Sub-processing of this DPA.

Privacy Policy

When you open the EVALINK Site, our servers automatically record information that your browser sends. This data may include information such as your device's IP address, browser type and version, operating system type and version, language preferences or the webpage you were visiting before you came to the EVALINK Site and Services, pages of the EVALINK Site and Services that you visit, the time spent on those pages, information you search for on the EVALINK Site, access times and dates, and other statistics.

Information collected automatically is used only to identify potential cases of abuse and establish statistical information regarding the usage and traffic of the EVALINK Site and Services. This statistical information is not otherwise aggregated in such a way that would identify any particular EVALINK Account of the system.

You can access and use the EVALINK Site and Services without telling us who you are or revealing any information by which someone could identify you as a specific, identifiable individual. If, however, you wish to use some of the features on the EVALINK Site, you may be asked to provide certain Personal Information (for example, your name and e-mail address). We receive and store any information you knowingly provide to us when you create an EVALNK Account, make a purchase, or fill any online forms on the EVALINK Site. When required, this information may include the following:

Personal details such as name, country of residence, etc.

Contact information such as email address, address, etc.

Account details such as user name, unique user ID, password, etc.

Proof of identity such as photocopy of a government ID.

Payment information such as credit card details, bank details, etc.

Geolocation data such as latitude and longitude.

Information about other individuals such as your family members, friends, etc.

Any other materials you willingly submit to us such as articles, images, feedback, etc.

Some of the information we collect is directly from you via the EVALINK Site and Services. However, we may also collect Personal Information about you from other sources such as public databases, social media platforms, third-party data providers, and our joint marketing partners. Personal Information we collect from other sources may include demographic information, such as age and gender, device information, such as IP addresses, location, such as city and state, and online behavioral data, such as information about your use of social media websites, page view information and search results and links. You can choose not to provide us with your Personal Information, but then you may not be able to take advantage of some of the features on the EVALINK Site.

3. Use and processing of collected information

In order to make the EVALINK Site and Services available to you, or to meet a legal obligation, we need to collect and use certain Personal Information. If you do not provide the information that we request, we may not be able to provide you with the requested products or services. Any of the information we collect from you may be used for the following purposes:

Create and manage EVALINK Account and End User

Send marketing and promotional communications

Enforce terms and conditions and policies

Respond to legal requests and prevent harm

Run and operate the EVALINK Site and Services

Processing your Personal Information depends on how you interact with the EVALINK Site and Services, where you are located in the world and if one of the following applies: (i) you have given your consent for one or more specific purposes; this, however, does not apply, whenever the processing of Personal Information is subject to California Consumer Privacy Act or European data protection law; (ii) provision of information is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof; (iii) processing is necessary for compliance with a legal obligation to which you are subject; (iv) processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in us; (v) processing is necessary for the purposes of the legitimate interests pursued by us or by a third party.

Note that under some legislations we may be allowed to process information until you object to such processing (by opting out), without having to rely on consent or any other of the following legal bases below. In any case, we will be happy to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Information is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

We use third party payment processors to assist us in processing your payment information securely. Such third party processors' use of your Personal Information is governed by their respective privacy policies which may or may not contain privacy protections as protective as this Policy. We suggest that you review their respective privacy policies.

You are able to delete certain Personal Information we have about you. The Personal Information you can delete may change as the EVALINK Site and Services change. When you delete Personal Information, however, we may maintain a copy of the unrevised Personal Information in our records for the duration necessary to comply with our obligations to our affiliates and partners, and for the purposes described below. If you would like to delete your Personal Information or permanently delete your EVALINK Account, you can do so on the settings page of your EVALINK Account on the EVALINK Site.

Depending on the requested Services or as necessary to complete any transaction or provide any service you have requested, we may contract with other companies and share your information with your consent with our trusted third parties that work with us, any other affiliates and subsidiaries we rely upon to assist in the operation of the EVALINK Site and Services available to you. We do not share Personal Information with unaffiliated third parties. These service providers are not authorized to use or disclose your information except as necessary to perform services on our behalf or comply with legal requirements. We may share your Personal Information for these purposes only with third parties whose privacy policies are consistent with ours or who agree to abide by our policies with respect to Personal Information. These third parties are given Personal Information they need only in order to perform their designated functions, and we do not authorize them to use or disclose Personal Information for their own marketing or other purposes.

We will disclose any Personal Information we collect, use or receive if required or permitted by law, such as to comply with a subpoena, or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

In the event we go through a business transition, such as a merger or acquisition by another company, or sale of all or a portion of its assets, your EVALINK Account, and Personal Information will likely be among the assets transferred.

We will retain and use your Personal Information for the period necessary to comply with our legal obligations, resolve disputes, and enforce our agreements unless a longer retention period is required or permitted by law. We may use any aggregated data derived from or incorporating your Personal Information after you update or delete it, but not in a manner that would identify you personally. Once the retention period expires, Personal Information shall be deleted. Therefore, the right to access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after the expiration of the retention period.

Depending on your location, data transfers may involve transferring and storing your information in a country other than your own. You are entitled to learn about the legal basis of information transfers to a country outside the European Union or to any international organization governed by public international law or set up by two or more countries, such as the UN, and about the security measures taken by us to safeguard your information. If any such transfer takes place, you can find out more by checking the relevant sections of this Policy or inquire with us using the information provided in the contact section.

You may exercise certain rights regarding your information processed by us. In particular, you have the right to do the following: (i) you have the right to withdraw consent where you have previously given your consent to the processing of your information; (ii) you have the right to object to the processing of your information if the processing is carried out on a legal basis other than consent; (iii) you have the right to learn if information is being processed by us, obtain disclosure regarding certain aspects of the processing and obtain a copy of the information undergoing processing; (iv) you have the right to verify the accuracy of your information and ask for it to be updated or corrected; (v) you have the right, under certain circumstances, to restrict the processing of your information, in which case, we will not process your information for any purpose other than storing it; (vi) you have the right, under certain circumstances, to obtain the erasure of your Personal Information from us; (vii) you have the right to receive your information in a structured, commonly used and machine readable format and, if technically feasible, to have it transmitted to another controller without any hindrance. This provision is applicable provided that your information is processed by automated means and that the processing is based on your consent, on a contract which you are part of or on pre-contractual obligations thereof.

Where Personal Information is processed for the public interest, in the exercise of an official authority vested in us or for the purposes of the legitimate interests pursued by us, you may object to such processing by providing a ground related to your particular situation to justify the objection. You must know that, however, should your Personal Information be processed for direct marketing purposes, you can object to that processing at any time without providing any justification. To learn, whether we are processing Personal Information for direct marketing purposes, you may refer to the relevant sections of this document.

If you are a resident of the European Economic Area (EEA), you have certain data protection rights and Sitasys aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Information. If you wish to be informed what Personal Information we hold about you and if you want it to be removed from our systems, please contact us. In certain circumstances, you have the following data protection rights:

You have the right to request access to your Personal Information that we store and have the ability to access your Personal Information.

You have the right to request that we correct any Personal Information you believe is inaccurate. You also have the right to request us to complete the Personal Information you believe is incomplete.

You have the right to request the erase your Personal Information under certain conditions of this Policy.

You have the right to object to our processing of your Personal Information.

You have the right to seek restrictions on the processing of your Personal Information. When you restrict the processing of your Personal Information, we may store it but will not process it further.

You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.

You also have the right to withdraw your consent at any time where Sitasys relied on your consent to process your Personal Information.

You have the right to complain to a Data Protection Authority about our collection and use of your Personal Information. For more information, please contact your local data protection authority in the European Economic Area (EEA).

In addition to the rights as explained in this Policy, California residents who provide Personal Information (as defined in the statute) to obtain products or services for personal, family, or household use are entitled to request and obtain from us, once a calendar year, information about the Personal Information we shared, if any, with other businesses for marketing uses. If applicable, this information would include the categories of Personal Information and the names and addresses of those businesses with which we shared such personal information for the immediately prior calendar year (e.g., requests made in the current year will receive information about the prior year). To obtain this information please contact us.

Any requests to exercise your rights can be directed to Sitasys through the contact details provided in this  document. Please note that we may ask you to verify your identity before responding to such requests. Your request must provide sufficient information that allows us to verify that you are the person you are claiming to be or that you are the authorized representative of such person. You must include sufficient details to allow us to properly understand the request and respond to it. We cannot respond to your request or provide you with Personal Information unless we first verify your identity or authority to make such a request and confirm that the Personal Information relates to you.

We do not knowingly collect any Personal Information from children under the age of 18. If you are under the age of 18, please do not submit any Personal Information through the EVALINK Site and Services. We encourage parents and legal guardians to monitor their children's Internet usage and to help enforce this Policy by instructing their children never to provide Personal Information through the EVALINK Site and Services without their permission. If you have reason to believe that a child under the age of 18 has provided Personal Information to us through the EVALINK Site and Services, please contact us. You must also be at least 16 years of age to consent to the processing of your Personal Information in your country (in some countries we may allow your parent or guardian to do so on your behalf).

The EVALINK Site and Services use "cookies" to help personalize your online experience. A cookie is a text file that is placed on your hard disk by a web page server. Cookies cannot be used to run programs or deliver viruses to your computer. Cookies are uniquely assigned to you, and can only be read by a web server in the domain that issued the cookie to you.

We may use cookies to collect, store, and track information for statistical purposes to operate the EVALINK Site and Services. You have the ability to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. If you choose to decline cookies, you will not be able to use and experience the features of the EVALINK Site and Services. To learn more about cookies and how to manage them, visit internetcookies.org

This Privacy Policy makes an integral part of our EVALINK Agreement.

1. Features & Capabilities

2. Billing

3. Definitions